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INFORMATION SYSTEMS AUDITS 


Information Systems (IS) audits conducted by the Legislative 
Audit Division are designed to assess controls in an IS 
environment. IS controls provide assurance over the accuracy, 
reliability, and integrity of the information processed. From 
the audit work, a determination is made as to whether controls 
exist and are operating as designed. We conducted this IS audit 
in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform 
the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides 
a reasonable basis for our finding and conclusions based on our 
audit objectives. Members of the IS audit staff hold degrees in 
disciplines appropriate to the audit process. 


IS audits are performed as stand-alone audits of IS controls or 
in conjunction with financial-compliance and/or performance 
audits conducted by the office. These audits are done under 
the oversight of the Legislative Audit Committee, which is a 
bicameral and bipartisan standing committee of the Montana 
Legislature. The committee consists of six members of the Senate 
and six members of the House of Representatives. 
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The Legislative Audit Committee 
of the Montana State Legislature: 


This is our information systems audit of Unmanned Aircraft Systems use by Montana 
state agencies. This report provides information on how state agencies’ use these 
aircraft and includes recommendations for the Governor’s Office to improve statewide 
operational and information technology policy, oversight, and public outreach across 
the state. A written response from the Governor’s Office is included at the end of the 


report. 
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17DP-05 REPORT SUMMARY 


In January 2018 there were one million registered unmanned aircraft 
systems nationwide with 122,000 belonging to commercial and public 
operators with estimates to increase to 455,000 by 2022. Currently, eight 
state agencies plan to use or are using unmanned aircraft in their operations 
and we determined their use can improve business processes. However, 
improvements are needed for deployment of these systems to provide 
coordination and oversight of unmanned aircraft in state government 
related to pilot certification and training, safe use and citizen privacy, and 





protection of data gathered. 





Context 


Unmanned Aircraft Systems (UAS) are being 
deployed by governments and businesses across 
the country. Eight Montana state agencies 
currently use, or plan to use, these systems to 
monitor construction sites, observe wildlife, 
investigate vehicle crashes, and contribute 
to academic research, among other uses. We 
reviewed the Department of Environmental 
Quality; Department of Natural Resources 
and Conservation; Department of Justice; 
Department of Fish, Wildlife & Parks; 
Department of Livestock; Department of 
Transportation; Montana State University; 
and the University of Montana were reviewed 
as part of our audit work. Though not 
reviewed as part of our work, the Department 
of Corrections and Montana State Library 
have shown interest in using aircraft. The 
Department of Commerce used to fly UAS but 
due to a change in staff no longer use them. 
By incorporating unmanned aircraft into their 
operations, agencies may reduce both operating 
and personnel services costs and increase 
performance of their operations. However, 
launching an unmanned aircraft program is 
not without its challenges, including initial 


cost of equipment, training pilots, developing 
policy, and complying with Federal Aviation 
Administration regulations. We reviewed the 
risks and benefits of UAS implementation by 
state agencies, assessed agency compliance with 
state and federal regulations, and determined if 
unmanned aircraft usage is consistent, properly 
managed, and subject to appropriate review 
across the state. 


Results 


We found Montana does not coordinate efforts 
when it comes to agency UAS implementation. 
Agencies are following federal regulations but 
lack oversight and guidance when adhering 
to best practices. While examining current 
unmanned aircraft activities across eight state 
agencies, we identified a lack of consistency 
in operational procedure and policy. Agencies 
are duplicating effort when it comes to policy 
creation and are missing key aspects of a 
complete unmanned aircraft policy. Due to 
limited information on unmanned aircraft 
use within state government, we determined 
the state would benefit from providing 


(continued on back) 
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information outreach as well as a main 
contact point for interested parties. Based 
on our review, a central resource would 
improve consistency, provide guidance to 
agencies, ensure regulatory compliance, 
provide informational sessions to local 
government and other state agencies, and 
provide information to the public on state 
government unmanned aircraft use. Our 
audit includes five recommendations to the 
Governor's Office that address issues related 
to cost-benefit analysis, central unmanned 
aircraft resource, information outreach, 
and unmanned aircraft operational and IT 


policy. 


Recommendation Concurrence 


Source: Agency audit response included in 
final report. 





For a complete copy of the report (17DP-05) or for further information, contact the 
Legislative Audit Division at 406-444-3122; e-mail to lad@mt.govy; or check the web site at 


https://leg.mt.gov/lad/audit-reports 
Report Fraud, Waste, and Abuse to the Legislative Auditor's FRAUD HOTLINE 


Call toll-free 1-800-222-4446, or e-mail LADHotline@mt.gov. 





Chapter | — Introduction and Background 


Introduction 


Unmanned Aircraft Systems (UAS) go by many names; these include Unmanned 
Aerial Vehicle, Unmanned Aircraft Vehicle, small Unmanned Aircraft Vehicle, drone, 
and quadcopter. The Federal Aviation Administration (FAA) uses the term Unmanned 
Aircraft System and for this report we will use this term when referring to these 
systems. An unmanned aircraft is an aircraft without a human pilot onboard - instead, 
it is controlled from an operator on the ground. The Unmanned Aircraft System is 
composed of the unmanned aircraft itself, a ground-based controller, and a system of 
communications between the two. Similarly, the entire system, the unmanned vehicle 
and its communication system have a variety of names, including: Unmanned Aerial 


System, Small Unmanned Aircraft System, and Unmanned Aircraft System. 


Figure 1 depicts a human operator using a ground control station to operate the 
unmanned aircraft. The aircraft and ground control station are connected via data 
link. The entire figure is the unmanned aircraft system. 


Figure 1 
Unmanned Aircraft System Diagram 
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Source: Created by the Legislative Audit Division. 





Unmanned aircraft have a wide variety of applications. These applications can include 
crop surveys, aerial photography, inspection of power lines and pipelines, education, 
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journalism, and counting wildlife. There are four main users of unmanned aircraft: 
governmental, commercial, educational, and recreational. There are regulations set 
in place by the FAA for these users to own and operate unmanned aircraft. These 
regulations include listed requirements set forth by the FAA’s Small Unmanned 
Aircraft Rule (Part 107), and Certificates of Authorizations. 


With clear requirements set forth by the FAA and low costs to purchase an unmanned 
aircraft, the number of users is the highest it has ever been. Nationwide, the number 
of commercial and public-sector operators is at 122,000 with the number expected 
to increase to 455,000 by 2022. Our audit work determined unmanned aircraft use 
is also increasing in Montana. According to the FAA, there are over 4,000 registered 
unmanned aircraft in Montana. As the number of operators continues to grow, the 
importance of proper management increases, particularly regarding transparency of 
use in government operations and the privacy protection of citizens. 


UAS are an important and new technology that change physical space. This 
change comes with benefits as well as risks. It is important to appropriately manage 
government UAS use to mitigate the risk. This audit was prioritized by the Legislative 
Audit Committee in 2017 after a legislative request was conducted in 2015 related to 


unmanned aircraft use in state government. 


Audit Objectives 


Our objectives during the audit were to: 


1. Determine the potential benefits and risks of Montana state government 
agencies using unmanned aircraft in their operations. 


2. Determine if state agencies comply with Federal Aviation Administration 
regulations and Montana state law to own and operate an unmanned aircraft. 


3. Evaluate Montana agency unmanned aircraft programs and determine if 
clear guidance is provided at the statewide level to ensure proper use and 
transparency. 


Audit Scope 


‘The scope of our audit focused on FAA regulations and compliance, coordination of 
Montana's state agency unmanned aircraft usage, and impacts of their use, such as 
increased costs, cost savings, and risk reductions or increases to the state of Montana. 
The audit focused on how state agencies use unmanned aircraft and if procedure 
follows regulations and aligns with best practices. The time frame of our review 
was calendar year 2017-2018. The agencies reviewed included: the Department of 
Commerce; Department of Environmental Quality; Department of Natural Resource 
and Conservation; Department of Justice; Department of Fish, Wildlife & Parks; 


Department of Livestock; Department of Transportation; Montana State University; 


and the University of Montana. We selected these agencies because they are either 


using unmanned aircraft or in the process of implementing these aircraft into their 


operations. Due to the number of agencies involved with these aircraft, the audit team 


directed recommendations to the Office of the Governor. 


Audit Methodologies 


The following methodologies were conducted to answer our objectives: 


Sa 


Reviewed standards and regulations for unmanned aircraft usage established 
by Montana and the Federal Aviation Administration (FAA). 


Interviewed FAA staff regarding unmanned aircraft federal policy and 
registration requirements. 


Reviewed current Montana laws and regulations, as well as past proposed 
legislation related to state agency unmanned aircraft use. 


Reviewed state agency unmanned aircraft program policies and procedures 
and observed flights at the Department of Environmental Quality, 
Department of Transportation, and University of Montana. 


Researched other states/organizations with unmanned aircraft programs to 
identify best practices for program structure. 


Surveyed the eight agencies (100 percent response rate) to understand the 
level of unmanned aircraft development for each state agency. Information 
gathered included the age of program, development of operation policies, 
scope of operations, size of support staff, and research conducted when 
establishing their program. 


Conducted a cost savings comparison of state agency unmanned aircraft use. 
This included an assessment of agency operating costs prior to unmanned 
aircraft implementation, costs related to implementing and maintaining 
unmanned aircraft operations, and determining net savings or additional 
costs related to unmanned aircraft implementation. 


Reviewed unmanned aircraft operations in other states and compared 
them to Montana to identify potential benefits of use in state government 
operations. 


Interviewed Department of Administration procurement office staff to 
understand unmanned aircraft procurement procedures. 


Interviewed State Information Technology Services Division staff to 
understand technology controls over unmanned aircraft purchases and use. 


Interviewed Risk Management and Tort Defense Division staff to understand 
state insurance implications related to unmanned aircraft use. 


Interviewed Governor’s Office staff to determine its oversight role of 
unmanned aircraft use across state agencies. 


CO SEE 
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¢ = Interviewed unmanned aircraft staff at the University of Montana’s 
Autonomous Aerial Systems Office to determine if UM meets federal 
requirements and to observe an unmanned aircraft flight. 


Report Contents 


The remainder of this report discusses our audit work and includes chapters detailing 


our findings, conclusions, and recommendations in the following areas: 


¢ Chapter II addresses our work in determining state agency compliance with 
FAA regulations and state law. 


¢ Chapter II provides our cost savings comparison of state agency unmanned 
aircraft use. This chapter also discusses the benefits and risks of state agencies 
incorporating unmanned aircraft into their operations, and the importance 
of conducting a cost-savings analysis and of having a UAS central resource. 


¢ Chapter IV discusses state agency unmanned aircraft use and best practices, 
and compares Montana’s uses (of UAS) to those in other states. 


Chapter Il — Review of State Agency 
Compliance With Unmanned 
Aircraft Requirements 


Introduction 


This chapter discusses our objective to determine if state agencies, including the 
university system, comply with Federal Aviation Administration (FAA) regulations and 
state law. We discuss two different areas in this chapter. The first area focuses on FAA 
standards and regulation review. The second area discusses state agency unmanned 
aircraft procedures to determine if they align with FAA regulations and state law. We 
found Montana has few state laws or policies pertaining to unmanned aircraft use. 
Currently, most rules and regulations are at the federal level and were enacted by the 
FAA. Based on our review, state agencies are following federal regulations but have 
little guidance at the state level in terms of state laws or administrative rules. 


Federal Unmanned Aircraft Regulations 

Differ Based _ on the Type of User 

To determine the rules and regulations government operators must follow, we reviewed 
federal unmanned aircraft policy as well as the FAA’s preeminence over the National 
Airspace System. Governmental, commercial, educational, and recreational users 
have similar regulations they must follow but have different options to operate under. 
All unmanned aircraft under these regulations are considered “small” meaning the 
unmanned aircraft must weigh less than 55 pounds. It should be noted that flying 
a large unmanned aircraft (over 55 pounds) is permitted via a public Certificate of 
Waiver or Authorization or through an exemption, which are issued by the FAA. 


Requirements Applicable to Recreational Users 


Individuals can fly their unmanned aircraft for recreational purposes. To be considered 
a recreational user, individuals must meet these requirements: 


¢ — Fly for hobby or recreation only 
¢ Register unmanned aircraft with FAA 
¢ — Fly within visual line-of-sight 


¢ — Follow community-based safety guidelines and fly within the programming 
of a nationwide community-based organization 


¢ Unmanned aircraft must weigh under 55 pounds unless certified by a 
community-based organization 


¢ ~~ Never fly near other aircraft 


¢ Never fly near emergency response efforts 


0 SSE 
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The FAA Reauthorization Act of 2018 was signed into law in October 2018. Part of this 
act made minor changes to rules regarding the recreational use of unmanned aircraft. 
These changes did not impact government use. The FAA is evaluating the impacts of 
this change in law and how implementation will proceed. The Reauthorization Act 
was not fully implemented upon signing and the FAA is encouraging operators to 
follow all current policies and guidance with respect to recreational use of unmanned 
aircraft. 


Governmental and Other Users May 
Fly Under FAA Part 107 


Government entities, such as federal and state government agencies, law enforcement 
agencies, and public colleges and universities, have the option to follow the FAA’s Small 
Unmanned Aircraft Rule (Part 107). Part 107 has two main requirements: registering 
the unmanned aircraft and becoming an FAA certificated unmanned aircraft pilot by 
passing a knowledge test. Recreational, commercial, and educational users also have 
the option to operate under Part 107. 


Remote pilot certificate requirements include: being at least 16 years of age, having the 
ability to read, speak, write, and understand English; being in a physical and mental 
condition to safely operate an unmanned aircraft; and passing the initial aeronautical 
knowledge exam. Individuals wishing to receive their license for the first time must 
take and pass the initial aeronautical knowledge exam at an FAA-approved knowledge 
testing center. The aeronautical knowledge exam contains several questions relating 
to unmanned aircraft regulations such as airspace classification, aviation weather 
sources, effects of weather on unmanned aircraft performance, radio communication 
procedures, and safety and emergency procedures. ‘The certificate should be easily 
accessible by the remote pilot during all unmanned aircraft operations and is valid for 
two years. 


The FAA provides “regulatory flexibility” in its unmanned aircraft regulations that 
come in the form of waivers. Examples of Part 107 waivers include: 


¢ Operations from a moving vehicle 
¢ — Operation over people 


¢ = Operation of multiple unmanned aircraft 


Pilots submit a waiver application to the FAA containing information such as responsible 
party, operation parameters, justification, and existing waivers. The approval process 
can take up to 90 days. 


Additional Certification Requirements 
for Government Users Only 


During unmanned aircraft’s early integration into the National Airspace System, the 
only way for a government operator to operate an unmanned aircraft was through a 
public Certificate of Authorization (COA), which is an authorization issued by the 
FAA to a public operator for specific unmanned aircraft activity. Only government 
entities, such as federal and state government agencies, law enforcement agencies, 
and public colleges and universities, can receive a COA for public unmanned aircraft 
operations. A COA generally has all the requirements of Part 107 but can also have 
special exceptions preemptively approved by the FAA. To receive a COA, agencies are 
required to fill out detailed sections on an application including procedures, flight 
operations area/plan, flight aircrew qualifications, and any special circumstances for 
operations. In most cases, the FAA will provide a formal response within 60 days from 
the time a completed application is submitted. In 2016, the FAA implemented Part 
107 to make unmanned aircraft rules easier to understand. This gave public operators 
two options to fly, Part 107 or a COA, based on their operation needs. 


Federal Oversight of National Airspace Limits State and 
Local Governments Regulation of Unmanned Aircraft Use 


The FAA has preeminence over the National Airspace System. This preeminence limits 
state and local governments ability to enact laws and ordinances concerning unmanned 
aircraft use. For example, in December 2016 the city of Newton, Massachusetts passed 
a law to ban unmanned aircraft flights below 400 feet, ban flights over private and 
public property without landowner’s permission, and require local registration of 
unmanned aircraft. However, a federal judge in Massachusetts in 2017 ruled the city 
does not have authority due to the FAA’s preeminence over the airspace. 


The FAA does recognize areas of shared responsibility with state and local governments. 
Cities and states can pass laws and ordinances regarding land use, zoning, privacy, 
trespass, and law enforcement operations. For example, according to the FAA, a state 
or city could implement no launch and no land zones where they deemed necessary 
and not overstep the FAA’s preeminence over the airspace. These laws and ordinances 
would not overstep the FAA’s preeminence over the airspace. 


Through interviews with FAA officials, we found states do not have any enforcement 
responsibilities related to unmanned aircraft. According to FAA officials, the FAA 
focuses on educating individuals who fly unmanned aircraft and the burden for 
compliance generally falls on the individual who holds the certificate. The act of 
enforcing unmanned aircraft laws is difficult, because according to FAA officials the 
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agency does not have staff available across the country to do so. With education in 
mind, the FAA is focusing on a preventative approach to address unmanned aircraft 
misuse. If an individual is misusing an unmanned aircraft, FAA officials indicated it is 
best to contact local law enforcement because of their ability to get to the scene quicker 
than the FAA. Additionally, the FAA developed the “Law Enforcement Guidance for 
Suspected Unauthorized Unmanned Aircraft Operations” to help law enforcement 
manage the use of unmanned aircraft in their jurisdiction. 


Montana State Laws and Policy 
Pertaining to Unmanned Aircraft 


According to the Montana Operations Manual (MOM) policy “Advanced 
Procurement Requirements and Issues,” Risk Management & Tort Defense Division 
(RMTD) has developed an aid to determining appropriate insurance requirements for 
various risk levels. We interviewed RMTD officials to learn about insurance policies 
surrounding unmanned aircraft. The State of Montana self-insures all unmanned 
aircraft purchased for agency use. Agency unmanned aircraft are automatically covered 
by liability insurance immediately after procurement and would be classified under the 
self-propelled or specialized equipment category. This is a “catch-all” category so it is 
not broken down specifically into unmanned aircraft. If there were to be an accident 
involving an unmanned aircraft, the incident would be covered by state insurance if it 
occurred during normal work conditions. Agencies can get additional comprehensive 
and collision insurance, which is tracked by RMTD. If an agency were to get the 
additional coverage this should be reported to RMTD as soon as they procured the 
unmanned aircraft. Agencies can also purchase additional coverage for unmanned 
aircraft procured in past years if they have not already. 


Our work found there were nine unmanned aircraft with this additional coverage 
from the Department of Environmental Quality, Department of Natural Resources 
and Conservation, Montana State University, and the University of Montana. Based 
on automatic coverage of liability insurance, we determined agencies are following 
Montana insurance policy. MOM policy also states any commercial unmanned aircraft 
operation is permitted on state grounds through the Unmanned Aircraft Systems Use 
Permit. Our audit work found no permits had been issued to date. 


Legislative Actions Regarding Unmanned Aircraft Use 


Over the last several legislative sessions, the Montana Legislature has raised. several 
questions regarding unmanned aircraft use in Montana. Several bills have been 
introduced in a piecemeal approach to address various areas regarding how and where 


unmanned aircraft can be used. Some bills have passed and been enacted into law, 
while other have not. Recent bills that were introduced but not passed into law include: 


¢ Establishing requirements for operations of unmanned aircraft (HB0593, 
2015). 


¢ Limiting unmanned aircraft use and prohibiting any governmental entity 
within the State of Montana from owning or using unmanned aircraft with 
weaponry (SB0150, 2013). 


¢ — Providing civil penalties for unauthorized operation of an unmanned aircraft 
over real property (SB0170, 2017). 


¢ Prohibiting use of unmanned aircraft near certain airports, emergency 
operations, or aerial spraying operations (HB0586, 2015). 


¢ — Restrict the use of unmanned aircraft systems near critical infrastructure 


(HB0655, 2019). 


Recently enacted legislation clarifies unmanned aircraft use by law enforcement and 
increases safety during wildfire suppression efforts. Specifically, §46-5-109, MCA, 
limits when law enforcement can use information from an unmanned aircraft as 
evidence in court. Additionally, §7-32-401, MCA, prohibits law enforcement from 
acquiring armored or weaponized unmanned aircraft. Chapter 274, Laws of the 
2017 Regular Session, prohibits interference with wildfire suppression efforts using 
privately owned unmanned aircraft, and prevents the enactment of local ordinances 
allowing unmanned aircraft use during active wildfire suppression efforts. It also sets 
penalties for individuals equivalent to the reasonable costs of obstructing, impeding, 
preventing, or interfering with an aerial wildfire suppression response effort. 


While these laws relate to unmanned aircraft use, outside of law enforcement and 
insurance, they do not provide guidance to state agencies regarding their use or 
acquisition of unmanned aircraft. Based on our review, there is limited guidance in state 
law or policy that references unmanned aircraft use. Therefore, the only regulations 
state agencies must currently follow when owning and operating unmanned aircraft 
are federal. Following federal regulations is important, but they do not provide specific 
policy and expectations for state agencies when using unmanned aircraft in their 
operations. 


State Agency Compliance With Federal Regulations 


We evaluated state government agencies and university system procedures pertaining 
to unmanned aircraft use. Each agency reviewed currently uses, plans to use, or has 
used unmanned aircraft. These included the Department of Commerce, Department 
of Environmental Quality (DEQ), Department of Natural Resources and 
Conservation (DNRC), Department of Fish, Wildlife & Parks (FWP), Department 
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of Transportation (MDT), Department of Justice (DOJ), Department of Livestock 
(DOL), Montana State University (MSU), and University of Montana (UM). The 
Department of Commerce was the only agency that previously used unmanned 
aircraft, but no longer uses them because unmanned aircraft licensed staff left the 
department. DEQ, MDT, MSU, DOJ, DOL, and UM are currently using unmanned 


aircraft within their organizations. 


We determined all agencies operate under Part 107, except for the universities 
which operate under several COAs. ‘The following sections discuss the results of our 
comparison of whether state agencies complied with the requirements. While Part 107 
is consistent within its requirements, COAs had varying requirements; therefore, we 
had to review each university's COA to determine if these requirements were being 


met. 


State Government Agencies Meet Federal Unmanned 
Aircraft and Pilot Licensing Requirements 


In 2015, the FAA Reauthorization Act authorized the FAA to create the unmanned 
aircraft registration database. The database will provide for more efficient confirmation 
of pilot licensing and unmanned aircraft vehicle registration. At the time of the 
audit, the FAA was still working on getting the database operational, so the database 
information was incomplete. Therefore, we requested copies of agency aircraft 
registration certificates and pilot licenses to determine compliance with federal 
unmanned aircraft and pilot licensing requirements. We found all agencies currently 
using unmanned aircraft have properly registered them and have licensed pilots. 


Observation of State Government Unmanned Aircraft 
Flights Found FAA Flight Regulations Are Followed 


Our work included observing unmanned aircraft flights conducted by agencies with 
active unmanned aircraft programs. This included DEQ, MDT, and UM. Our 
observations were conducted to verify each agency followed FAA flight regulations. 
Examples of flight regulations that must be followed include pilots maintaining 
a visual line-of-sight of the unmanned aircraft, not operating over any persons not 
directly participating in the operations, flying only in daylight hours, conducting 
preflight inspections, obtaining landowner permission, and not exceeding an altitude 
of 400 feet above the ground. Our observations found each agency followed all FAA 
flight regulations as required. The following sections briefly describe each observation 
we conducted. 

¢ DEQ conducted an unmanned aircraft flight over Prickly Pear Creek to take 


before and after video of creek restoration work. Since the flight was within 
five miles of Helena Regional Airport, DEQ was required to obtain a waiver 


from the FAA. DEQ obtained the necessary waivers. The flight also occurred 
over private land and landowner permission was obtained prior to the flight. 


Our observations found DEQ followed all relevant FAA rules during this 
unmanned aircraft flight. 


¢ We observed an MDT flight intended to show unmanned aircraft mapping 
capabilities, teach other MDT employees how to use the unmanned aircraft, 
and test a new terrain mapping feature. The flight took place four miles west 
of I-15 near Helena. ‘The flight occurred over private land and we found 
landowner permission was obtained prior to the flight. We verified MDT 
employees went through proper FAA pre-flight inspections of the unmanned 
aircraft and followed all FAA operating procedures for the aircraft's flight. 


¢ UM has a dedicated unmanned aircraft office, called the Autonomous 
Aerial Systems Office (AASO), which oversees its unmanned. aircraft 
program. Our final observation flight took place at the UM campus where 
AASO co-directors were training a student. ‘The training consisted of going 
through a pre-flight checklist and various aerial maneuvers. UM operates 
under a COA and were within guidelines for this flight training. These 
guidelines included maintaining direct, two-way communication with the 
air traffic control, receiving formal training from a qualified instructor, and 
documenting all operations associated with the flight. 


O_O 
CONCLUSION 


State agencies and operators are complying with FAA regulations for 
unmanned aircraft, including licensing and registration and obtaining 
necessary insurance coverage. However, state-level oversight, laws, and 
administrative rules for unmanned aircraft are minimal. 
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Chapter IIl - Unmanned Aircraft 
Benefits and Risks 


Introduction 


This chapter addresses our objective to evaluate the benefits and risks of unmanned 
aircraft use. We gathered information from state agencies on the costs and savings 
associated with their unmanned aircraft programs. We also reviewed the cost of agency 
operations with unmanned aircraft and those without. This was done by comparing 
agency business costs for operations that use unmanned aircraft to similar activities 
that do not use unmanned aircraft. We examined the risks associated with unmanned 
aircraft use such as potential privacy issues, safe use of the aircraft, data storage, and 
data retention. Finally, we reviewed the need for a central resource to coordinate 
unmanned aircraft oversight at the state level. 


We found while there are upfront costs to starting unmanned aircraft programs, 
state agencies have experienced cost savings when using them in their operations. 
Unmanned aircraft provide benefits including savings in operations, decrease in time 
spent on operations, and reducing safety risk to state workers. However, there are also 
risks involved with their use, including security of data obtained, employee workstation 
vulnerability, and risk of losing control of unmanned aircraft during flights. Agencies 
are not conducting thorough cost-benefit analyses to determine ifan unmanned aircraft 
is necessary at the agency, and Montana agencies lack guidance on implementing 
unmanned aircraft programs. This chapter includes two recommendations involving a 
cost/benefit analysis requirement and implementation of a central Unmanned Aircraft 
System (UAS) resource for Montana. 


Costs Associated With Unmanned Aircraft Programs 


We conducted a survey to gather information from various state agencies regarding 
their deployment of an unmanned aircraft program. The agencies surveyed were 
those we initially identified as using unmanned aircraft. These agencies included 
Department of Transportation (MDT); Department of Justice (DOJ); Department 
of Environmental Quality (DEQ); Department of Livestock (DOL); Department 
of Natural Resources and Conservation (DNRC); Department of Fish, Wildlife & 
Parks (FWP); the University of Montana (UM); and Montana State University 
(MSU). All eight agencies responded to our survey. Survey questions related to the 
age of their unmanned aircraft program, development of program operation policies, 
number of staff involved in the program, costs for procuring and using unmanned 
aircraft, expectation of program growth, the potential need for state shared resources, 
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and any research conducted in establishing their program. The table below shows 
agency reported aircraft and pilots. Agency pilots are employees that have other job 
responsibilities in addition to pilot responsibilities. 


Table 1 
Total Unmanned Aircraft & Pilots at Agencies 








Unmanned Aircraft Pilots 





1 2 





2 1 





4 





4 





5 











UM 





Total 

















Source: Compiled by the Legislative Audit Division from survey data. 


Standard Costs for Unmanned Aircraft Implementation 


We conducted a cost review of unmanned aircraft use across state agencies. Information 
was gathered from agency survey work and interviews with agency staff. Every 
unmanned aircraft program must have a licensed Federal Aviation Administration 
(FAA) Part 107 pilot. The FAA requires all pilots to pass an Aeronautical Knowledge 
exam. The cost to take this exam is $150. The FAA provides study materials online 
free of charge, but agencies can also choose to take pilot training courses that vary in 
cost. Unmanned aircraft pilots must renew their license every two years by taking the 
recurrent exam at a cost of $150. 


Once an agency has a pilot, there is the cost of the unmanned aircraft itself. The typical 
unmanned aircraft that agencies are currently using costs around $2,000. However, 
there are more advanced unmanned aircraft that can cost upwards of $10,000 each. In 
addition, each unmanned aircraft must be registered at a cost of $5 per aircraft and is 
valid for three years. 


There are various software costs associated with unmanned aircraft. This software 
can cost $150 per month for unmanned aircraft flying and mapping capabilities 
and $350 per month for cloud-based processing. There may be other software cost 
depending on how unmanned aircraft will be used. For example, since a typical photo 
session with an unmanned aircraft can take up to 2 gigabytes, there may be additional 
data storage costs as well, depending on an agency’s data usage. To create specialized 
imagery, software can cost an estimated $3,500 for a lifetime professional license. 


Unmanned aircraft have the added cost of insurance. According to Risk Management 
and Tort Defense Division (RMTD), when an unmanned aircraft is reported to them, 
it increases the number of insured units (same as any other vehicle procurement). The 
number of insured units is what determines the vehicle liability insurance premium 
charged to an agency. If an agency were to obtain additional liability insurance, the 
premium would cost 1.5 percent of the value of the unmanned aircraft, which would 
be around $30 per unit for an unmanned aircraft valued at $2,000. 


Financial Cost of Unmanned Aircraft 
Implementation Estimated by Agencies 


While the licensing, registration, unmanned aircraft, and equipment/software 
purchases are all needed to start and maintain an unmanned aircraft program, there 
are other costs that vary significantly across agencies. Since unmanned aircraft use 
is relatively new in the state, there is limited centralized tracking and information 
regarding agency unmanned aircraft use, including any type of the “true” cost of the 
unmanned aircraft. Therefore, we relied on cost information provided by agency staff 
regarding unmanned aircraft expenditures. 


Table 2 (see page 16) illustrates the number of hours each agency estimated spending 
on their unmanned aircraft program, including policy development and staff training. 
The table also includes the agency’s estimated operating costs, including the costs to 
purchase unmanned aircraft, certify pilots, and register each unmanned aircraft. 
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Table 2 
Montana Agency UAS Program Creation Total Cost & Hour Estimation 








Agency Total Hours Total Cost Cost Per Hour 





170 $1,900 $11.18 





175 $4,000 $22.86 





25 $5,000 $200.00 





660 $25,500 $38.64 





$35,000 $35.00 





$40,000 $80.00 





UM $300,000 $60.00 





MSU* 60 NA NA 

















Source: Compiled by the Legislative Audit Division from agency-submitted data. 





*MSU calculated cost on a per pilot basis. 


As illustrated in Table 2, UM has the highest unmanned aircraft hours and cost. 
This is because UM has the Autonomous Aerial Systems Office where they have 
been conducting training, certification/licensing, and policy-making over the course 
of three years. DEQ has the highest unmanned aircraft use among executive branch 
agencies logging 1,000 hours of flight time and spending $35,000 over the course of 
seven years. MSU does not have a central unmanned aircraft office on campus, and 
due to the distributed nature of those operations, it is difficult to estimate total cost 


and time. 


We obtained cost information from each agency currently using unmanned aircraft. 
These costs included amounts spent to purchase the unmanned aircraft, staff training, 
and policy development. We also obtained information on how these agencies use 
these aircraft in their operations. The following are some examples of unique figures 

related to the unmanned aircraft programs. 
¢ DOJ spent $25,500 on their unmanned aircraft program. This included 
$19,000 to purchase unmanned aircraft (9 total), $1,550 for the FAA prep 


course, and $2,400 for 16 state troopers to take the FAA Remote Pilot 
licensing exam. 


¢ DEQ received a policy template from a national unmanned aircraft workshop 
and has spent 20 hours creating policy. 


¢ DNRC has spent roughly 200 hours of personnel time on unmanned aircraft 
policy research and creation with a focus on ensuring citizen privacy is kept 
during unmanned aircraft flights. 


¢ UMestimated it spent $300,000 in costs on the unmanned aircraft program 
using school allocated funds over the course of three years. 


a 
CoNcLUSION 


While some agencies were able to provide estimated costs for their programs, 
no formal cost analysis had been conducted. This makes it difficult to 
determine the true or expected costs associated with implementing an 
unmanned aircraft program. 





Current Operational Use and Savings Reported by Agencies 


Agencies were asked to provide cost estimates of operations with and without unmanned 
aircraft usage. We also asked them to provide information on how unmanned aircraft 
are used in agency operations. We used this to conduct a savings comparison and 
determine how unmanned aircraft were used at DOL, DOJ, DEQ, and MDT. UM 
and MSU did not have a savings comparison completed because their programs focused 
on research rather than replacing current operations. DNRC and FWP did not have 
a cost savings comparison completed because their unmanned aircraft programs were 


not operational at the time of the audit. 


DOL uses unmanned aircraft to observe bison in West Yellowstone and Gardiner and 
occasionally to locate missing livestock. Prior to using unmanned aircraft, DOL flew 
helicopters at a cost of $800-1,200 per hour. After the implementation of unmanned 
aircraft these same tasks cost $50-100 per hour. According to DOL staff, the 
department also reduces risks to employees since they do not need to fly in a helicopter 
to accomplish these tasks. 


DOJ’s main purpose for using unmanned aircraft is for staff of the Montana Highway 
Patrol to enhance crash investigations and reconstruct crash scenes. DOJ staff recognize 
there are potential additional benefits, such as rescue operations, natural disaster 
response, and civil disturbance situations, but currently only use unmanned aircraft 
for crash scene investigations and reconstruction. According to DOJ officials, officers 
would take approximately two hours, on average, to conduct crash scene investigations 
and reconstruction before they began using unmanned aircraft. As part of most crash 
scene investigations, DOJ officials indicated officers would either use a man lift or 
helicopter to get above a crash scene to better assess the cause of the crash. Man lifts cost 
$400-$500 per use, and if it were needed after regular business hours it would cost up 
to $1,600. A helicopter costs $400-$500 per hour, meaning a two-hour investigation 
using helicopter assistance could cost as much as $1,000 for a single investigation. 
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DOJ officials currently view the cost of using unmanned aircraft as negligible since 
the resources are already acquired and manpower is already being spent during the 
crash investigation whether the unmanned aircraft is deployed or not. They indicated 
the time to conduct crash investigations with unmanned aircraft is reduced to around 
20 minutes instead of 2 hours without the use of the aircraft. DOJ officials said this 
also helps reduce the time roads might be closed while crash investigations are being 
conducted. For example, based on MDT’s road user cost delay spreadsheet, closing one 
lane of interstate during rush hour near Billings could cost up to $27,000 per hour. 
Since unmanned aircraft reduce crash investigations to approximately 20 minutes, the 
total cost of a single investigation is reduced from $54,000 to approximately $9,000. 


DEQ uses unmanned aircraft to monitor construction projects and to create 
orthomosaics of mining sites and archaeological sites. An orthomosaic is an accurate 
photo representation of an area, created out of many photos that have been stitched 
together and geometrically corrected so that it is as accurate as a map. To obtain 
the high-resolution data without unmanned aircraft, DEQ would have to hire a 
contractor (including data processing) for an estimated total cost of $1,000 to $2,000. 
DEQ officials indicated using agency personnel and unmanned aircraft would cost 
approximately $300 to conduct the same work. DEQ officials noted immediate 
high-resolution data acquisition is unavailable from satellite images. 


MDT uses unmanned aircraft for bridge inspections, landslide monitoring, 
environmental documentation (such as emergency stream bed repair), and measuring 
large stockpile volumes (such as gravel piles and other materials). According to MDT 
staff, traditional surveys to measure stockpiles would cost about $1,800 compared to 
approximately $180. MDT also monitors active rock fall sites and potential landslide 
areas to help ensure motorist safety. Traditionally, MDT would collect imagery 
of these areas using a helicopter with an hourly cost of $2,500. When using an 
unmanned aircraft, the total cost of these monitoring activities is approximately $400. 
MDT officials also indicated using unmanned aircraft reduces safety risks to MDT 
employees since they do not have to fly in a helicopter to monitor these sites. MDT staff 
indicated the department received an increase of federal share for construction projects 
of $6.7 million due to incorporating unmanned aircraft into their operations. Table 3 
(see page 19) is a summary of savings realized by agencies incorporating unmanned 
aircraft into their operations. 


Table 3 
Montana Agency Unmanned Aircraft Savings 








Unmanned Aircraft Cost of Operation Before Cost of Operation With 


Ea) Operation Unmanned Aircraft Unmanned Aircraft 





Observation of bison in 
West Yellowstone and 
Gardiner & occasionally 
missing livestock 


DOL $800-$1,200 $50-$100 


DOJ Crash Scene Investigation $500-$1000 $0 





Monitor Construction on 
DEQ Linear Facilities 


$1,500 $300 


Measure stockpile - $1,800 Measure stockpile - $180 
Measure Stockpile & 
Monitor Rock Fall Areas Monitor Rock Fall Areas Monitor Rock Fall Areas 
- $5,000 - $400 


Source: Compiled by the Legislative Audit Division from agency-submitted data. 


MDT 




















As expected, there are costs associated with starting unmanned aircraft programs 
including acquiring aircraft, creating policy, and training employees to be unmanned 
aircraft pilots. However, agencies using unmanned aircraft have reported savings and 
safety risk reduction to employees using these programs. Currently, agency unmanned 
aircraft operations are limited in size and scope but could potentially be expanded to 
other areas of operations. 


a 
CoNcLUSION 


While agencies were able to provide estimated savings for their programs, 
along with benefits including increased safety to employees, no formal 
documentation or review occurred prior to the program being established. 
This makes it difficult to determine the purpose of the program and whether 
expected savings or benefits have occurred. 


There Is Need for a Cost-Benefit Analysis 
Before Unmanned Aircraft Procurement 


Montana agencies are procuring unmanned aircraft to fulfill operational needs without 
a thorough cost-benefit analysis being conducted. There are not any requirements in 
place for agencies to conduct this analysis before the purchase of an unmanned aircraft. 


Over the course of the audit, through the survey and interviews, we reviewed the 
steps agencies took when deciding to purchase an unmanned aircraft and whether 
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a cost analysis was conducted on their UAS program. Agencies have taken a variety 
of approaches to assessing their UAS needs. For example, DNRC and DEQ have 
looked to other states and the federal government to see how other organizations have 
conducted cost analysis and procurement. The University of Montana Autonomous 
Aerial Systems Office has established goals for their UAS program. These goals include 
coordinating and guiding faculty, staff, and students, establishing infrastructure 
and resources, and stimulating UAS-related innovation. For the most part, agencies 
established their unmanned aircraft program for one specific task. Of the eight agencies 
surveyed only one has begun the process of conducting a cost/benefit analysis of their 
program. Overall, agency approach to procurement is varied. 


Cost-Benefit Analysis Recommended in Best Practices 


Other states and publications have recommended and implemented an analysis of 
unmanned aircraft before they are purchased. For example, in Utah any UAS purchase 
must go through the UAS office. There they review the purpose for the purchase to 
make sure there is a return on investment for its use. Additionally, they determine 
if someone in the division requesting the purchase has gone through Utah’s UAS 
training and has a license from the FAA. Once the UAS office has conducted their 
review, the purchase then goes through the normal procurement process. The National 
Institute of Justice published an article titled “Considerations and Recommendations 
for Implementing an Unmanned Aircraft Systems (UAS) Program.” This publication 
outlines actions needed to be completed by the agency internally before implementation 
of the program. Specifically, an agency should identify the actual need for an 
unmanned aircraft technology in relation to its mission. An agency needs to identify 
the specific scenarios where the aircraft would be used. Next, an agency needs to 
determine whether the specific UAS technology that best matches their intended use is 
commercially available and should conduct an analysis to determine if there is another 
method for performing the mission. Agencies should research options of sharing the 
unmanned aircraft with other agencies. Finally, an agency should evaluate whether it 
can support the technology. Questions agencies should be answering include: 


¢ Are there processes in place to support funding, storage, maintenance, and 
training considerations? 


¢ What type of staff should conduct the UAS operation? 
¢ Who will be responsible for UAS in the agency? 
¢ How often will the UAS be used? 


¢ — Ifthe agency has an aviation unit, will UAS operations fall within the scope 
of that unit’s responsibilities? 


The publication also provides a “Technology Decision Tool.” This tool is used to 
conduct a cost/benefit analysis of implementing a UAS program. 


Agency Needs May Not Require UAS Procurement 


After an agency addresses these cost-benefit questions, they could potentially choose 
not to procure an unmanned aircraft due to risk or cost. Since state agencies are 
not required to conduct a cost/benefit analysis prior to moving forward with a UAS 
program, they could be investing in a program that does not meet their mission or 
needs. Agencies have options outside of starting a UAS program. Since starting up a 
UAS program can be expensive and time-consuming, agencies could contract out to 
either private companies or to other state agencies for their unmanned aircraft needs. 
Drones as a Service is offered by private companies that are hired to perform a specific 
task using an unmanned aircraft. Contracting out can save agencies time and money 


if they find they have a limited need to own an unmanned aircraft. 


Newer Technology With a Lack of Oversight 


Due to the lack of statewide resources and oversight, there are currently no requirements 
in place to have agencies conduct a cost-benefit analysis before purchasing an unmanned 
aircraft. While some agencies have asked cost-benefit questions prior to starting their 
program, it is not consistent across agencies. Therefore, it is unclear whether current 
unmanned aircraft use across state agencies is providing a positive cost/benefit to the 
State of Montana. 


RECOMMENDATION #1 


We recommend the Governor’s Office require a cost-benefit analysis be 
performed before the procurement of an unmanned aircraft by state agencies. 


TL 


State Agencies Are Currently Using Unmanned 
Aircraft and Most Plan to Expand Operations 


Our survey results show agency unmanned aircraft programs at varying levels of 
maturity, with plans to increase use in the future. DEQ was one of the first agencies to 
operate unmanned aircraft in spring of 2011; so, it is to be expected there would likely 
be differences in the size and scope of each agency’s unmanned aircraft program. Our 
work found state agency unmanned aircraft programs vary in size ranging from one 


aircraft to twenty aircraft and one pilot to sixteen pilots licensed in their programs. 


Five of the eight agencies surveyed see their programs increasing in scale, including 
both pilots and aircraft, over the next five years. For example, DEQ hopes to have 
10 unmanned aircraft pilots while adding additional unmanned aircraft equipment. 
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MDT wants to investigate expanding into an unmanned aircraft rental program 
where they would rent unmanned aircraft to agencies with proper pilots. Challenges 
that could arise in creating a rental program include logistics for state agencies to access 
unmanned aircraft, pilot training and licensing issues, and ownership or establishment 
of rental rates. 


There are both low and high levels of unmanned aircraft use at state agencies with 
some using them more than others. Surveyed agencies report having varying uses 
for unmanned aircraft and how often they use them. For example, FWP and MDT 
reported their unmanned aircraft may see flight once or twice a month. It should be 
noted that FWP stopped flights while UAS policy is being created. MSU and UM, 
whose flights are based on research, will vary on volume but activity can be classified as 
weekly. DOJ expects their unmanned aircraft flights to become routine as more staff 
are trained to use them during vehicle crash investigations. 


Additional Unmanned Aircraft Opportunities 
Exist for State Agencies 


We surveyed state agencies currently using unmanned aircraft in their operations to 
determine how these aircraft are being used. We interviewed agency staff regarding 
unmanned aircraft use. We also reviewed information from other states and 
interviewed officials from those states regarding how they use unmanned aircraft 
in their operations. We used this information to conduct a comparison of Montana 
state agency unmanned aircraft use to agencies in other states. This comparison 
was conducted to determine if there were additional uses and benefits Montana 
agencies have yet to realize. We were able to make comparisons for MDT, DOJ, and 
DEQ. A few examples of additional unmanned aircraft use include: using infrared 
technology to identify adverse man-made chemicals, to create thermal imagery, and 
to conduct Light Detection and Ranging; conducting retaining wall and confined 
space inspections, live-feed disaster response for flooding, earthquakes, fire events over 
highways; and avalanche surveying. These other uses do not encapsulate all potential 
uses for an unmanned aircraft, but they do highlight that Montana can apply them to 
areas beyond current use. 


Departments of Transportation and law enforcement agencies across the United States 
are the main users of unmanned aircraft technology. However, there are still areas in 
which other entities can use unmanned aircraft in their operations. It should be noted 
that Montana agencies have room to grow, but before new operations are considered, 
agencies must first ensure that privacy, security, and flight rules and regulations are 
followed at all times. 


Risks Associated With Unmanned Aircraft Implementation 


Our work determined there are also risks of unmanned aircraft use that need to be 
considered. ‘The first risk relates to public privacy and potential negative perception of 
state agencies using unmanned aircraft. For example, private citizens can be concerned 
if a UAS is being used by government agencies near their homes. Secondly, computer 
networks and data collected by unmanned aircraft can be at risk when unmanned 
aircraft are connected to state computer networks for data transfer. Lastly, there are 
potential safety issues with unmanned aircraft. For example, a pilot losing control of 
an aircraft during its flight increases the risk of collisions with people, other aircraft, or 
structures. An injury to a third party or their property could leave the state vulnerable 
to lawsuits. While risks can never be fully mitigated, agencies should take steps to 
reduce these risks. We provide more information regarding these risks and how to 
mitigate them later in the report. 


PC ——_— 
CoNcLUSION 


Unmanned aircraft use comes with both risks and benefits. However, as use 
increases, state government will have to consider and address risks including 
data security, public privacy, and negative public perception of state agencies 
using unmanned aircraft in their operations. To fully weigh the benefits and 
risks of unmanned aircraft usage a proper analysis should be conducted. 


Central Resource Needed Prior to Agencies Expanding 
or Implementing Unmanned Aircraft Programs 


Our work found eight state agencies are currently using or have plans to incorporate 
them into their operations. We also found other agencies that expressed interest in 
incorporating unmanned aircraft in the future. Overall, this is a technology that is 
likely to grow in use within Montana state government. Currently, it is difficult to 
access information on Montana unmanned aircraft usage and requirements because 


there is no central resource or informational outreach. 


The legislature has limited knowledge on which state agencies are using unmanned 
aircraft and how they are using them. State agencies are currently not required to 
report unmanned aircraft numbers or how they are being used to any oversight body, 
including the legislature. Additionally, Montana does not have any requirements when 
it comes to oversight of unmanned aircraft usage at state agencies. However, agencies 
are in favor of a coordinated effort. 
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Agencies See Need for Shared Unmanned Aircraft Resources 


Our survey asked agencies about their current resource levels for their unmanned 
aircraft program. Six of the eight agencies responded that a statewide shared resource 
would benefit their program. For example, agencies expressed interest in areas such as 
information and data exchange, shared equipment, policy development, pilot training, 
and communication with the FAA. Each agency was asked what statewide shared 
resources their unmanned aircraft program would benefit from. Agency responses 
included unmanned aircraft federal and state standards and regulations information, 
pilot training, assistance with FAA communications, information and data exchange 
between state agency unmanned aircraft programs, and sharing of unmanned aircraft 
and pilots during emergency situations. After identifying agency needs we looked to 
other states to see what oversight they had in place. 


Another shared resource we researched was the potential for a UAS motor pool for the 
state of Montana. There were concerns that agencies would not be able to use UASs 
in a timely manner. For example, DOJ uses UASs for crash scene investigations and 
instead of using their own UAS, they would have to go through the rental process. 
For agencies with limited need, a UAS pool or rental program could potentially be 
beneficial. 


Best Practices Identified in Other States 


We contacted other states to identify potential best practices for unmanned aircraft 
oversight at the state level. We found other states have more defined reporting 
requirements for their unmanned aircraft programs, including specific requirements 
set forth in state law. For example: 


¢ Illinois state law requires law enforcement agencies using unmanned 
aircraft to report the number of aircraft they have to the Illinois Criminal 
Justice Information Authority. The Authority then makes a report available 
online with information about every law enforcement agency that owns an 
unmanned aircraft. 


¢ Nevada law requires the Nevada Department of Public Safety to include 
information regarding registered unmanned aircraft on its website. The 
department also must report to the legislature about public agency use of 
unmanned aircraft. 


¢ In North Carolina, any agency can start an unmanned aircraft program on 
their own accord. However, their legislature passed a law in 2014 that put the 
North Carolina Department of Transportation in charge of administering all 
unmanned aircraft programs and permits for government and commercial 
use of unmanned aircraft. North Carolina requires agencies to pass an 
additional test on North Carolina-specific unmanned aircraft laws. 


¢ — In Ohio, the Governor’s Office put the Ohio Department of Transportation 
(ODOT) in charge of unmanned aircraft activities. This includes exploring 
federally-approved unmanned aircraft flight test sites to help implement 
unmanned aircraft use safely and effectively across Ohio government. In 
2013, the Ohio Unmanned Aircraft Systems Center was created under 
ODOT. Agencies can have their own unmanned aircraft related polices 
but the center has flight manuals, checklists, standard policies, and a safety 
review board. 


¢ The Utah Department of Transportation (UDOT) oversees unmanned 
aircraft use in the state. UDOT developed statewide unmanned aircraft 
policy and procedures state agencies must follow. Agencies in Utah have 
created their own policies as well to address specific operations at each agency. 


Overall, we found other states have been more proactive than Montana has in 
establishing their unmanned aircraft programs. 


A recent national research publication outlines ways to effectively deploy unmanned 
aircraft programs in state and local government. This publication discusses the trends 
of unmanned aircraft use in government, getting unmanned aircraft programs started, 
and ongoing program needs. ‘The report also discusses the emergence of best practices 
to deploy and operate unmanned aircraft in the public sector. While there is not a “one 
size fits all” solution, state government must first identify a strategy for deploying and 
operating unmanned aircraft. This strategy should include developing requirements 
for individual agencies to procure and operate unmanned aircraft, partner with an 
outside provider, or coordinate unmanned aircraft with another state agency. 


We found other states and national research showed some state government agencies 
have created “Unmanned Aircraft Divisions,” responsible for overseeing all agency 
unmanned aircraft activities, while other state agencies have dispersed unmanned 
aircraft responsibilities across multiple divisions. Unmanned aircraft best practices 
also indicate it is important to identify opportunities to pool data, training, and 
maintenance. Federal and state laws and regulations are constantly being updated 
and public-sector leaders should monitor ongoing changes in regulations and laws 
governing the use of unmanned aircraft. There should be a means for ensuring agencies 
using unmanned aircraft understand and comply with these federal and state laws and 
regulations. Best practices indicate a UAS central resource is beneficial for integrating 


unmanned aircraft into state operations. 


Options Exist for Placement of Central Resource 


Due to the lack of a specific location outlined in best practices Montana has some 
options for the placement of a UAS central resource. When interviewing other states 
about their UAS central resource location, we found that the state chose to place the 
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resource with the subject matter expert. In North Carolina, Ohio, and Utah, these 
experts were located within the Department of Transportation. Another possible 
location would be through the university system. For example, North Dakota 
UAS Authority, which is comprised of all subject matter experts from the state, is 
administratively attached to the University of North Dakota. Legislation in other 
states such as Texas and Nevada have designated their Departments of Public Safety 
to keep track of unmanned aircraft activity at agencies and report to the legislature. In 
Michigan, the legislature put together an unmanned aircraft task force to decide how 
the state should proceed with UAS integration into agency operations. ‘This task force 
reviewed Michigan’s needs and made recommendations to the legislature on how to 
proceed. 


Currently, Montana has subject matter experts across the state. 


¢ — As with other areas that affect a majority of the agencies in Montana, the 
Department of Administration is an option for placement of the central 
resource. 


¢ MDT has experience working with the FAA. Currently the Engineering 
Division at MDT is working on an unmanned aircraft rental program and 
has recently started incorporating flights into operations. 


¢ The University of Montana’s Autonomous Aerial Systems Office has 
experience working with the FAA and following regulations involving Part 
107 and Certificate of Authorizations. 


¢ ‘Through the use of a task force or SITSD work group, the state can get 
together all subject matter experts to be involved in determining the 
best location for the UAS central resource. Currently Kreh Germaine, 
CIO, DNRC is heading an Information Technology Manager’s Council 
workgroup to address UAS policy. 


Presently, Montana has no central resource providing oversight of unmanned aircraft 
use by state government agencies. We found this has led to inconsistent unmanned 
aircraft policies between agencies and does not ensure consistent knowledge of 
unmanned aircraft regulations. These inconsistencies increase the risk of not following 
unmanned aircraft flight requirements, safety concerns when operating unmanned 
aircraft, or infringing on citizen privacy. There is also no process or resource where 
state agencies should report their number of unmanned aircraft, their flight activities, 
or how these aircraft are being used by state government agencies. There is no oversight 
on how unmanned aircraft policies have been or are currently being developed and 
if they meet or will meet the expectations of public officials, including the Governor 
and the Legislature. Montana should designate a central resource that is responsible 
for establishing state policy regarding unmanned aircraft use, ensuring federal and 
state regulations are met, and providing public outreach regarding state government 


unmanned aircraft activities. 


Ne 


RECOMMENDATION #2 


We recommend the Governor's Office designate a central unmanned aircraft 
resource to provide oversight and coordinate statewide unmanned aircraft 
efforts and ensure agencies report on unmanned aircraft numbers and usage. 
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Chapter IV —- Agency Unmanned Aircraft 
Operations and Coordination 


Introduction 


This chapter addresses our objective to evaluate state agency unmanned aircraft 
programs and determine if clear guidance is provided at the statewide level to ensure 
proper use and transparency. This chapter addresses several areas including unmanned 
aircraft outreach, operational policy, and information technology (IT) best practices 
related to unmanned aircraft. 


We found a lack of statewide guidelines for implementing unmanned aircraft into 
agency operations. Additionally, because unmanned aircraft collect data and can be 
connected to state of Montana computer networks, they should be considered a state 
IT asset. However, there is not a structure in place to ensure IT best practices are 
followed for unmanned aircraft, including procurement and data security policies. 
This chapter provides recommendations in each of these areas. 


Montana’s Unmanned Aircraft Information 
and Outreach Is Limited 


Since no public or governmental information to identify which state agencies operate 
unmanned aircraft is available in Montana, we surveyed individual agencies. Through 
the survey work, we determined state agencies either are currently using unmanned 
aircraft in their operations or have used them in the past. 


When reviewing other states, we discovered that information about unmanned 
aircraft usage could be found on their websites. Oregon, North Carolina, Utah, Ohio, 
North Dakota, Texas, California, Idaho, Wyoming, and Nevada all have information 
available online on how to operate an unmanned aircraft in their state. These webpages 
contain information on federal and state regulations, workshop dates and locations, 
contact information, agency unmanned aircraft activities, and policy templates. ‘This 
allows for easy access by other state agencies, local government, citizens, the legislature, 
and other states. 


There have been instances where other states’ legislatures tasked a department to help 
other agencies with unmanned aircraft. These departments have put on workshops 
to provide transparency and information to other state agencies, citizens, commercial 
operators, and other states. For example, the North Carolina Department of 
Transportation’s program holds a one-day regional workshop once a quarter where 


agency staff and other individuals can receive training and information on unmanned 


CO SSE) 


29 


30 | Montana Legislative Audit Division Legislative Audit Division 


aircraft. The Michigan Unmanned Aircraft Systems Task Force report recommends the 
development of an education and outreach strategy to address coordinated educational 
outreach efforts for local governments, law enforcement, and other users. These 
outreach programs help state agencies identify potential uses of unmanned aircraft and 
the necessary steps to establish such programs. Not only are these outreach programs 
a benefit to state agencies, but they also benefit local governments and private citizens. 


Montana has neither designated a subject matter expert on unmanned aircraft nor 
designated a central location for unmanned aircraft information. Therefore, state 
agencies are left to develop their programs from the ground up, creating duplication and 
upfront time researching federal and state requirements. Having information readily 
available on unmanned aircraft will help ensure consistent information is available to 
state agencies and provide easy access to those wishing to operate in Montana. 


Ne 


RECOMMENDATION #3 





We recommend the Governor’s Office ensure information is available to state 
agencies, the public, local government, and legislators on the application, 
viability, regulations, and best practices of unmanned aircraft. 


TO 


Improvements to Unmanned Aircraft 
Operational Policy Needed 


Unmanned aircraft policy can be broken down into three different areas: operational, 
Information Technology (IT) best practices, and regulations. Figure 2 (see page 31) 
illustrates the elements of these policy types. 


Figure 2 
Elements of Unmanned Aircraft Policy 





Operational —— IT Best Practices -—— Regulations 


Data, Storage, Retention, 


Transfer, Standardization Feoisletiel Gs Seite Le 


Definitions 


Personnel Permissions 











Security & Risk 


Management Documentation 


Training 


Pre, Mid, Post Flight Procurement & Asset 
Operations Management 


Emergency Procedures 


Flight Area/Perimeter 
Management 


External & Flight Crew 
Communications 


Accident Reporting 


Source: Compiled by the Legislative Audit Division. 


Having consistent policy ensures all relevant areas related to unmanned aircraft are 
covered (such as state and federal compliance). Unmanned aircraft policy at each 
agency differs based on intended uses but best practices indicate there should be a 
consistent template or starting point for these policies. 


Most Agency Unmanned Aircraft Policy Is 
Currently in Draft Form and Fragmented 


Each agency surveyed provided us with an established or draft unmanned aircraft 
policy except for the Department of Fish, Wildlife & Parks, who reported staff were 
still working to create policies. At the time of the audit, the Department of Justice 
(DOJ) and Department of Transportation (MDT) were the only agencies to have their 
own finalized policy, outside of Federal Aviation Administration (FAA) requirements. 
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We reviewed both finalized and draft policies provided by each agency to evaluate the 


level of consistency between these policies. Each policy we reviewed is briefly described 


below: 


° 


MDT policy outlines when unmanned aircraft may be used to conduct 
MDT business (cost efficiency, improved data quality, etc.) and procedures 
for training, maintenance, safety, operation, and flight data. 


DOJ’s Montana Highway Patrol Division has unmanned aircraft policy 
detailing how to obtain digital aerial photographs, video, and data in support 
of crash investigations, crime scene investigations, and any other purpose 
authorized by a district commander. 


The Department of Environmental Quality (DEQ) has an unmanned 
aircraft policy manual in draft. The draft policy outlines appropriate uses for 
unmanned aircraft, the appointment and responsibilities of an Unmanned 
Aircraft Manager, data retention requirements, unmanned aircraft request 
process, flight procedures including pilot qualifications and responsibilities, 
and visual observer qualifications and responsibilities. 


The University of Montana (UM) currently has draft policy describing how 
the university acquires and operates unmanned aircraft efficiently and safely. 
UM also has a dedicated unmanned aircraft office called the Autonomous 
Aerial Systems Office (AASO), and a webpage describing how students and 
staff can operate unmanned aircraft. AASO provides centralized oversight 
for UM and coordinates the campus’ unmanned aircraft operations. This 
includes ensuring unmanned aircraft and pilots meet federal requirements 
and providing guidance for incorporating unmanned aircraft into research 
activities. 


Montana State University (MSU) has draft policy stating users must follow 
all FAA rules and guidelines and outlines the type of unmanned aircraft use 
allowed on MSU property. MSU’s draft policy also includes a requirement 
for operators to provide proof of unmanned aircraft insurance and where to 
obtain this insurance. 


The Department of Livestock (DOL) has draft policy outlining the uses 
of unmanned aircraft operations and responsibilities of flight personnel. 
Included in the draft are the pre-, mid-, and post-flight requirements and 
checklists with maintenance and monthly reporting duties. 


The Department of Natural Resources and Conservation (DNRC) has 
draft policy which includes procedures for procurement; administration; 
management (reports, timekeeping, and documentation); and aircraft 
accidents, incidents, and hazards. 


While our policy review identified agencies addressing specific pieces of best practice 


policy, we did not identify an agency that addressed all aspects including operational, 


IT best practices, and regulations. Despite most of unmanned aircraft policy across 


state agencies being in draft form and fragmented, agencies continue to use unmanned 


aircraft in their operations. Without proper policy or law in place, it is difficult to 


determine if state agency unmanned aircraft use is appropriate. There is potential for 
duplication of effort. Agencies are individually spending time creating policy when a 
coordinated effort would reduce time required for policy creation. Additionally, there 
is potential for conflicting unmanned aircraft policy across agencies. 


Other States Provide More Guidance 
Related to Unmanned Aircraft Policy 


When reviewing other states, we found that specific departments were designated 
with developing policy related to state and local use of unmanned aircraft, helping 
provide guidance to agencies in developing more consistent unmanned aircraft policies 
and procedures. We also found policies and procedures in other states covered most 
relevant areas related to unmanned aircraft operations within state government. These 
polices included personnel duties, training requirements and schedules, and pre, mid, 
post flight operation guidelines. Examples of policies developed in other states include: 

¢ The North Carolina Department of Transportation provides agencies an 


unmanned aircraft privacy best practice document and a template that 
includes standard operating procedures. 


¢ The Ohio Department of Transportation (ODOT) was tasked by their 
legislature to reach out to other agencies about potential unmanned aircraft 
use. Each agency has a specific unmanned aircraft policy but ODOT has a 
standard template and relevant information on policy, aircraft, and privacy. 


¢ The Utah Department of Transportation provides unmanned aircraft policy 
advice to any agency requesting assistance. This help comes in the form of 
policy templates and guidance on how to best perform specific unmanned 
aircraft activities at the agency. 


Currently, Montana agencies are on their own to develop unmanned aircraft policy. 
This had led to a duplication of efforts and policy gaps within each agency’s policy. 
In most cases, policy remains in draft form even though unmanned aircraft are 
being used by many of these agencies. Our work determined other states have more 
structured administration of their unmanned aircraft programs. This is mainly due 
to more centralized responsibility for policy development, information gathering on 
unmanned aircraft activities, and reporting of those activities. For example, we found 
other states share policy templates to help ensure unmanned aircraft are operated 
consistently statewide. These templates include sections such as an outline of unmanned 
aircraft program mission; personnel responsibilities; FAA requirements; privacy and 
permission requirements; training; pre-, mid-, and post-flight requirements/checklists, 
emergency procedures, accident reporting; internal and external communication 
requirements; and references to pertinent state law and FAA regulations. ‘The state of 
Montana should develop statewide unmanned aircraft policy that serves as the baseline 
for unmanned aircraft operations by state agencies. 
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RECOMMENDATION #4 





We recommend the Governor's Office develop statewide unmanned aircraft 
policy that ensures regulatory compliance is met at the state and federal level. 


TT 


Unmanned Aircraft IT Policy Best Practices 


IT policy tied to unmanned aircraft is an area that can be easily overlooked when 
developing policy. IT policy covers various areas such as unmanned aircraft 
procurement, data standardization, privacy, security and risk management, and asset 
management. One of the main issues states currently face is the increasing use of 
unmanned aircraft and the management of data created as a result. The following 
sections discuss these areas in further detail. 


Other States and Best Practices Discuss the 
Importance of the State CIO’s Involvement 


Other states have established specific IT policy related to unmanned aircraft use 
to ensure protection of state assets, including data. For example, Utah requires any 
unmanned aircraft procurement throughout the state to go through a review by 
the unmanned aircraft program located with the Department of Transportation. 
The unmanned aircraft program reviews purpose and return on investment for the 
purchase, and confirms that the employee at the division requesting the unmanned 
aircraft has gone through proper training and certification to operate the aircraft. 
Once this review is done, the purchase goes through the standard technology 
procurement process. In 2016, Oregon passed legislation requiring public bodies 
operating unmanned aircraft to establish policies and procedures for the “use, storage, 
accessing, sharing and retention of data.” Ohio, Utah, and North Carolina have also 
developed unmanned aircraft policy that addresses privacy. These policies include the 
requirements that any data collected only be related to the scope of unmanned aircraft 
flights, any data beyond the purpose of the unmanned aircraft flight must be deleted, 
all collected data is subject to public record laws and standard procedures exist for data 
collection. Policies also include how to address any violation of privacy. 


The National Association of State Chief Information Officers (NASCIO) represents 
state chief information officers and information technology executives and managers 
from the states, territories, and the District of Columbia. NASCIO released a report in 
2015 on Chief Information Officers’ (CIO) role in unmanned aircraft governance. The 
publication speaks to the importance of a proper governance structure and unmanned 


aircraft IT policy. It covers areas related to data standardization and recommends 
that states define the processes on how agencies obtain information via unmanned 
aircraft, labeling, storage, retention, usage, sharing, and deletion of unmanned aircraft 
information. The publication also addresses privacy as it relates to unmanned aircraft 
use. Unmanned aircraft are not only smaller, cheaper, and quieter than manned aircraft, 
but their technology allows them to gather more data during their flights. Since the use 
of technology to gather information can infringe on an individual’s right to privacy, 
states should develop a comprehensive framework related to unmanned aircraft 
privacy rules. NASCIO recommends states consider the potential consequences of 
unsecured data collected by unmanned aircraft. States should consider the possibility 
of unmanned aircraft being hacked and develop procedures to securely store collected 
data and protect flight control frequencies. Issues of both cybersecurity and information 
security should be considered. NASCIO recommends state governments maintain 
an inventory of agency unmanned aircraft ownership, applications, and uses, just as 
should be done with any technology asset. Lastly, NASCIO states a proper governance 
structure for unmanned aircraft needs to be in place to fully integrate existing efforts 
of state agencies, identify policy concerns, formalize internal controls and anticipate 
issues that may arise. 


State of Montana Can Improve Policy for 
Unmanned Aircraft Procurement 


We interviewed state agency staff about procurement practices for unmanned aircraft. 
Agencies procured unmanned aircraft by researching what aircraft would best fit 
their needs and all aircraft procured were under $5,000. While standard procurement 
policy leaves the procurement process up to the agency for purchases under $5,000, 
unmanned aircraft are connected to the state network, meaning they should be 
considered an IT procurement which has specific procurement requirements. 


The Montana Information Technology Act (MITA) states the Department of 
Administration (DOA) is responsible for providing centralized management and 
coordination of state policies for security of data and information technology resources. 
According to Montana Operations Manual (MOM) policy, information technology 
is defined as hardware, software, and associated services and infrastructure used to 
store or transmit information in any form, including voice, video, and electronic 
data. Policy further states that whenever an IT purchase is made, an Information 
Technology Procurement Request (ITPR) must be submitted by agencies. An ITPR 
is then submitted to State Information Technology Services Division’s (SITSD) 
Technical Review Board for review and approval. The ITPR process is in place to 
ensure information technology is procured at the best price, in the right quantity, and 
from the right source. 
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We reviewed unmanned aircraft purchases to determine if they followed appropriate 
IT purchasing practices. We found ITPRs completed and submitted by agencies for 
SITSD review were related to unmanned aircraft software acquisitions that assisted in 
the operation of the aircraft. DEQ submitted three ITPRs in 2018 related to unmanned 
aircraft and software for preflight checklist, and orthomosaic imagery creation. We did 
not find ITPRs for the unmanned aircraft themselves. SITSD and agency staff do not 
believe an ITPR is necessary when procuring unmanned aircraft. However, based on 
our review of MOM policy and how unmanned aircraft are being used, we believe 
they are considered an information technology procurement and the ITPR process 
should be followed when unmanned aircraft are purchased. 


Agency Policy Specific to Unmanned Aircraft 
Data Collection and Storage Varies 


Montana does not have unmanned aircraft policy addressing specific data collection, 
storage, retention, usage, sharing, acquisition, or privacy. Currently SITSD views 
unmanned aircraft as part of the Internet of Things (IoI). IoI' refers to the increasing 
number of devices that are interconnected via the internet. SITSD also uses the 
National Institute of Standards and Technology (NIST) General Controls as policy 
when it comes to these devices. Based on our review of NIST policy, we believe the 
policy is too broad and does not specifically refer to unmanned aircraft. 


While specific state IT policy related to unmanned aircraft use does not exist, 
individual agencies have addressed some aspects of IT policy within their unmanned 
aircraft policy. For example: 


¢ DEQ and DOL policy addresses data retention and public access, and 


mentions privacy. 


¢ DNRC draft policy addresses privacy and civil rights and liberties protections. 
This draft policy stipulates the agency will follow state of Montana and 
DNRC policy when it comes to privacy, transparency, reporting, tracking, 
and data management. 


¢ MDT policy addresses saving flight data and mandates storing videos only 
when necessary due to size of files. 


¢ DOJ policy states that all files associated with crash scene investigations 
shall be copied to a storage device and sent to Records Management for 
preservation in accordance with DOJ policy. 


¢ MSU draft policy mentions areas of campus where there are expectations of 
Privacy. 


¢ UM policy requires a data management and security plan that includes the 
type of data being recorded during unmanned aircraft operations, who will 
have access, how the data will be stored, and how it will be destroyed. 


While we determined each agency has incorporated some aspect of IT best practices 
into its respective policy, each policy is missing key aspects and policy requirements are 
inconsistent between agencies. For example, since unmanned aircraft are connected 
to state employee work computers and at times to the state network for data transfer, 
ensuring policy exists related to security and data collection, storage, retention, and 
privacy is vital. While SITSD has safeguards in place to address instances when 
devices are connected to the state network, each agency has different IT policy when it 
comes to connecting devices to employee workstations. As such, state agencies have not 
developed IT policies requiring appropriate levels of protection of the state network. 


Statewide IT Policy Should Be Developed to Address Risks 


Without having statewide IT policy related to unmanned aircraft, the state is vulnerable 
to potential security threats including pre-installed malware, extraction of sensitive 
data, loss of unmanned aircraft flight aircraft control, and agencies flying unmanned 
aircraft without proper certifications. Additionally, unmanned aircraft create large 
amounts of data which can potentially put hardship on the state network and agencies 
when sharing or downloading information. While agencies are currently collecting 
information via unmanned aircraft, without consistent IT policy in place to address 
data storage, the potential for additional resources being needed to re-organize stored 
unmanned aircraft data exists, along with potential privacy challenges, lawsuits, and 
security incidents. 


Our work found states should have a structure in place that ensures coordination of 
unmanned aircraft use and development of policy for unmanned aircraft procurement, 
asset management, data standardization, privacy, and security and management. 
Since SITSD is the agency responsible for providing centralized management and 
coordination of state policies for security of data and information technology resources, 
it will be important for SITSD to be involved in the development of IT policy related 
to unmanned aircraft and ensure the state’s IT assets are protected. 


In January 2019, SITSD’s Information Technology Managers Council created a 
workgroup to address unmanned aircraft and IoI needs in Montana. However, at the 
time of the audit, the group had not met or defined its objectives. 


a 


RECOMMENDATION #5 


We recommend the Governor's Office work with State Information 
Technology Services Division to develop statewide policy addressing IT 
risks on unmanned aircraft data standardization, privacy, security and risk 
management, procurement, and asset management. 
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Legislative Audit Division 
P.O. Box 201706 
Helena, MT 59620 


Dear Mr. Maciver: 


Thank you for the opportunity to respond to the Legislative Audit Division’s report, titled 
“Unmanned Aircraft Systems (UAS) Deployment and Oversight.” 


The report provides a thorough overview of UAS use in state agencies. Like with all new 
technologies, it is important for the State of Montana to realize the potential of UAS while 
recognizing potential complications that may arise from their use. The ultimate goal of a UAS 
program is to provide more effective and cost-efficient services while prioritizing Montanans’ 
right to privacy. This report will help facilitate the creation of a successful UAS program for the 
State of Montana. 


The Governor’s Office responses to the report’s recommendations are as follows: 
Recommendation #1: We recommend the Governor’s Office require a cost-benefit analysis be 
performed before the procurement of an unmanned aircraft by state agencies. 


Governor’s Office Response: Concur 


The Governor’s Office will distribute a memorandum directing all executive agencies to perform 
cost-benefit analyses before procurement of a UAS. 


Recommendation #2: We recommend the Governor’s Office designate a central unmanned 
aircraft resource to provide oversight and coordinate statewide unmanned aircraft efforts and 
ensure agencies report on unmanned aircraft numbers and usage. 


Governor’s Office Response: Concur 
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The Governor’s Office will facilitate creation of a UAS advisory council, comprised of VAS 
points of contact from relevant state agencies, by August 1, 2019. Agencies represented on the 
council will include: Department of Commerce (DOC); Department of Environmental Quality 
(DEQ); Department of Natural Resources and Conservation (DNRC); Department of Justice 
(DOJ); Department of Fish, Wildlife & Parks (FWP); Department of Livestock (DOL); 
Department of Transportation (MDT); Information Technology Services Division (ITSD); 
Montana State University (MSU); the University of Montana (UM); local governments; law 
enforcement; and other relevant stakeholders. 


Recommendation #3: We recommend the Governor's Office ensure information is available to 
state agencies, the public, local government, and legislators on the application, viability, 


_ regulations, and best practices of unmanned aircraft. 


Governor’s Office Response: Concur 


The Governor’s Office will task the UAS advisory council with organizing information and 
resources regarding UAS to be available to state agencies, the public, local government, and 
legislators within eighteen months of the council’s creation. 


Recommendation #4: We recommend the Governor’s Office develop statewide unmanned 
aircraft policy that ensures regulatory compliance is met at the state and federal level. 


Governor’s Office Response: Concur 


As the report shows, agencies are already in compliance with state and federal UAS regulations. 
The UAS advisory council will formalize the process of ensuring compliance and will be 
prepared to provide compliance consultation within twelve months of its creation. 


Recommendation #5: We recommend the Governor’s Office work with State Information 
Technology Services Division to develop statewide policy addressing IT risks on unmanned 
aircraft date standardization, privacy, security and risk management, procurement, and asset 
management. 


Governor’s Office Response: Concur 





There will be an SITSD representative on the UAS advisory council. The council will create 
statewide policy to ensure the privacy of Montana citizens and security of state data and 
information in relation to UAS use. Unmanned Aircraft Systems contain powerful technology 
with high potential for advanced data collection. The council must consider privacy and security 
as its primary priority and make decisions in consultation with the public and the moral code that 
governs our state and nation. 


I will serve as the main point of contact for the Governor’s Office until the UAS advisory 
council is created and convened. If you have any questions, please contact me at 444-3179 or 
raphael.graybill@mt.gov. 


Angus Maciver 
June 6, 2019 
Page 3 


Sincerely, 


Raphael Graybill 
Chief Legal Counsel 
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